CVE-2021-32702
📋 TL;DR
The Auth0 Next.js SDK versions 1.4.1 and lower contain a reflected cross-site scripting (XSS) vulnerability. Attackers can inject malicious JavaScript code via the 'error' query parameter during authentication callbacks, which gets executed in users' browsers. This affects any Next.js application using the vulnerable SDK version without custom error handling that properly sanitizes HTML output.
💻 Affected Systems
- @auth0/nextjs-auth0
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal user authentication tokens, session cookies, and sensitive data, potentially leading to full account compromise and lateral movement within the application.
Likely Case
Attackers can execute arbitrary JavaScript in victims' browsers, enabling session hijacking, credential theft, and client-side data exfiltration.
If Mitigated
With proper input validation and output encoding, the risk is reduced to minimal, though the vulnerable code path remains present.
🎯 Exploit Status
Exploitation requires tricking users into clicking a malicious link containing the XSS payload in the error parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2
Vendor Advisory: https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7
Restart Required: No
Instructions:
1. Update package.json to specify @auth0/nextjs-auth0 version 1.4.2 or higher. 2. Run 'npm update @auth0/nextjs-auth0' or 'yarn upgrade @auth0/nextjs-auth0'. 3. Rebuild and redeploy your Next.js application.
🔧 Temporary Workarounds
Implement Custom Error Handling
allCreate custom error handling that doesn't output error messages in HTML responses or properly sanitizes all user input.
Input Validation Middleware
allAdd middleware to validate and sanitize all query parameters before they reach the callback handler.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
- Deploy a Web Application Firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for @auth0/nextjs-auth0 version <= 1.4.1Check Version:
npm list @auth0/nextjs-auth0 | grep @auth0/nextjs-auth0Verify Fix Applied:
Verify installed version is >= 1.4.2 using 'npm list @auth0/nextjs-auth0' or check package.json📡 Detection & Monitoring
Log Indicators:
- Unusually long error parameter values in authentication callback URLs
- JavaScript patterns in error query parameters
Network Indicators:
- HTTP requests with script tags or JavaScript code in error query parameters
SIEM Query:
url:*error=*<script* OR url:*error=*javascript:*🔗 References
- https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf
- https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7
- https://www.npmjs.com/package/%40auth0/nextjs-auth0
- https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf
- https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7
- https://www.npmjs.com/package/%40auth0/nextjs-auth0
